Due Diligence Data Room Checklist: 174-Item Request List (2026)

Last updated: October 2026

A due diligence data room checklist is the full list of documents a seller puts in front of a buyer: the one below has 174 numbered items across 10 categories. A due diligence request list is the buyer's version of it, a spreadsheet of rows that arrives days after the letter of intent, each with a deadline. Answer that list in the order the buyer's reviewers need it (31 documents in week one, the rest by workstream over the following weeks) and map every row to a numbered folder in the room.

Scope: This is the full, deal-agnostic checklist for M&A, growth rounds and buyer diligence. If you are a startup raising seed or Series A, the leaner 60-document startup data room checklist is the faster starting point.

I'm Deqian Jia, co-founder of Peony, a data room used by 8,000+ customers in 60+ countries. I have helped set up due diligence rooms for company sales, fundraising rounds, PE buyouts and independent sponsor deals, and the pattern repeats: sellers prepare the documents and underprepare the list. The checklist tells you what a complete room holds. The request list tells you what the buyer wants this week, how far back it has to go, and what happens to a row you cannot answer. This guide covers both.

Key takeaways

• 174 numbered items, 10 categories. The IDs (1.01 to 10.16) double as folder numbers, so a buyer's request maps to one place in the room. Bloomberg Law's M&A checklist also lists 174 types of documents to consider requesting (first published in 2023).
• A request list is not the checklist. It is the buyer's deal-specific spreadsheet, sent by counsel and accountants days after the LOI, and it is different again from a DDQ and from data room Q&A.
• The Week-One Request Ladder: 31 of the 174 items, in five rungs ordered by the question each reviewer needs settled first.
• Lookbacks follow rules, not habit: 3 years for tax returns (IRS), 6 if income may have been under-reported by more than 25%; 3 years for payroll records (29 CFR 516.5); 5 years for OSHA logs.
• The room behind the list: a sub-$50M M&A room on Peony held about 1,206 files, 29 users and 79 Q&A questions, and the median room took 12.6 days from first opening to its first outside viewer (State of M&A Data Rooms, Q3 2026, 733 transactions).
• Run the list against the room's index. On Peony's Data Room plan ($52 per admin per month billed yearly), Index documents numbers every folder and file and Upload new version keeps each file's place and link. Peony has no built-in request tracker; the list stays in the spreadsheet both sides already use.

How do you use this due diligence checklist as a template?

Use the checklist as a reusable template: create one top-level folder per category, in the order below, and file each document under its item number. The 174 items are a superset. A sub-$50M asset sale rarely needs every line, so delete what does not apply (and say so in the request list, as covered below) and add the sector overlay for your industry. For folder naming and nesting, see the data room folder structure guide.

The skeleton to paste into any data room:

1  Corporate & Governance
2  Financial
3  Tax
4  Legal, Contracts, Insurance & Litigation
5  Customers & Revenue
6  HR & Employment
7  IP & Technology
8  Security & Privacy
9  Operations, Real Estate & Facilities
10 Regulatory, Compliance & Environmental
11 Confirmatory (gated, always last in the tree)

Two numbering choices, pick one. If your room numbers itself (Peony's Index documents does), leave the number prefixes off the folder names, or every folder shows two numbers. If you number by hand, prefix every name (01, 02, 03) so the order holds on any platform.

Quick navigation

• What a request list is and who sends it
• The Week-One Request Ladder
• Lookback periods
• How many requests to expect
• Running the list against the room
• The master checklist: 174 items
• Industry overlays
• 6 mistakes that delay deals
• Organizing the checklist with Peony
• Staged disclosure
• FAQ

---

What documents do buyers ask for in due diligence? The checklist at a glance

Buyers ask for the documents that prove three things: the earnings are real, the company owns what it says it owns, and nothing in the contracts, people or regulators changes after the sale. In practice that means financial statements and tax returns, the cap table and corporate records, material contracts, employee and benefits records, IP assignments, insurance and litigation, and regulatory filings.

A complete due diligence data room checklist spans 10 categories and 174 documents, 31 of which buyers ask for in the first week. The table is the skeleton: how many items each category holds, how many are week-one requests, and which reviewer on the buyer's side reads it most. The fully enumerated lists follow further down.

---

What is a due diligence request list, and who sends it?

A due diligence request list is the buyer's working document for diligence: a spreadsheet with one row per document or question, grouped by workstream, each with a requested-by date and a column for the seller's answer. Orrick's glossary defines it as "a list of questions and/or requests for documents" produced by a potential investor or purchaser "to aid the investor or purchaser in getting information about the company" (Orrick).

Who sends it. On most deals, two teams write the rows. The buyer's counsel covers corporate records, contracts, employment, IP, litigation and regulatory matters. The buyer's accountants, often the team running the quality of earnings review, cover financials, working capital and tax. Specialist advisers add their own rows for IT and cybersecurity, insurance, environmental or benefits. On a PE deal you can receive three or four lists from different firms. Ask buyer's counsel to merge them into one master sheet with one ID scheme before you start answering, or you will answer the same request three times.

When it arrives. In the deals I see, the full list lands within days of the signed letter of intent, because exclusivity starts the diligence clock and the buyer wants its reviewers working. Some buyers send a short pre-LOI list first (summary financials, customer concentration, headcount) to price the offer. After the first delivery, expect supplemental lists: reviewers read, find gaps and add rows. Near signing, a final round confirms nothing has changed and feeds the disclosure schedules.

How does a request list differ from a checklist, a DDQ and Q&A?

A checklist is what the seller prepares; a request list is what the buyer asks for; a DDQ asks for written answers; Q&A handles the follow-up questions. They overlap, and one deal often uses all four.

The practical consequence: do not answer a request-list row with a paragraph that belongs in Q&A, and do not answer a Q&A question with a document dump. A request row is closed by a file in a numbered place. A question is closed by an answer that points to that file.

---

What do buyers open first in a data room?

Buyers open the financial statements and model first, then the cap table, then the top customer contracts, then the litigation or disclosure summary. They are testing earnings quality and ownership before they spend time on anything else, so if those documents are missing or hard to find, confidence drops in the first session. Page-level analytics, on every Peony plan, show you whether your buyer follows this order and how long each reviewer spends on each page.

---

Which documents do buyers request in week one? The Week-One Request Ladder

In week one, buyers request the 31 documents that let each reviewer start work: authority and ownership records for counsel, three to five years of financials and tax returns for the accountants, the contracts that decide whether revenue survives the sale, the liabilities that come with the company, and the people, IP and permits that have to transfer. I call the order the Week-One Request Ladder: five rungs, each settling the question the next reviewer depends on.

Why the order matters. Rungs 1 and 2 start together because two different firms read them. Everything above them waits: counsel cannot scope which contracts need consent until it knows who owns the company, and the accountants cannot test add-backs in the EBITDA bridge without the monthly accounts beneath it. Answer in ladder order, not spreadsheet order. A request list sorted by category puts insurance policies next to the cap table; the ladder puts the cap table first because three other workstreams depend on it.

What stays off the first rung. Employee names, salary by person, customer-level pricing and supplier terms do not belong in week one, even if the list asks for them. Give anonymized versions (the census by role, the customer list by code) and release names to the final bidder, often only to a clean team of its advisers. The staged disclosure section below shows how.

What the ladder is not. It is not a prep timeline. If you are three months from launch, start with how to prepare for due diligence; the ladder assumes the documents exist and orders their release once the list arrives.

---

How far back should each document go?

Buyers usually want 3 to 5 years of annual financial statements and tax returns, 24 to 36 months of monthly accounts, and current versions of contracts and policies, with all-time history for formation documents, equity grants and IP assignments. The longer periods are not arbitrary: most track a statute of limitations or a federal record-keeping rule, which is also the period in which a liability could still surface after closing.

If the buyer asks for more than the table suggests, ask why before you push back. A 5-year tax request on a company that has had a state audit is reasonable; a 7-year request for every vendor invoice usually is not. For the full tax workstream, see the tax due diligence checklist.

---

How many requests should you expect, by deal size?

Expect a request list drawn from a superset of about 174 document types, trimmed to your deal and growing after the first delivery. There is no industry census of request-list length, and published ranges are rarely sourced. What can be measured is the room the list fills, and that scales with deal size.

Across 733 M&A transactions on Peony, from $1M to $500M, the Q3 2026 edition of the State of M&A Data Rooms found:

Two readings matter for the request list. First, a sub-$50M seller should not answer a 174-row list as if it were a $300M carve-out: about 1,206 files and 29 users is a focused room, and most rows outside the buyer's actual workstreams can be closed with a one-line N/A. Second, more paper does not mean more questions. In the largest bracket, the report found that "the ratio rose to about one question for every 21 files in large deals, from one in 13." Buyers on big deals read more and ask about the same amount, so findability decides how fast the request list closes.

How fast do buyers expect answers?

Buyers expect the first tranche within about two weeks and follow-up answers within days. On Datasite's platform, the global median preparation time fell to 12 days in Q3 2026, with APAC at 3 days, the Americas at 12 and EMEA at 17 (FF News, citing Datasite data, October 2026). On Peony, the median room took 12.6 days from its first opening to its first outside viewer in the same quarter. Two platforms, the same answer: the documents, not the software, set the clock.

The service levels I recommend once the list arrives (a working standard, not an industry rule):

In a competitive process the arithmetic gets worse: the median Peony room had 5.5 bidders in Q3 2026, and the same request arrives from each of them. Answer it once, file it once, and give every bidder group the same room reference.

---

How do you run a request list against the data room?

Treat the request list as the tracker and the room's numbered index as its filing system. Every row gets a room reference (the folder number plus the file name), a status, an owner on the seller's side and a date, and every document lives in exactly one numbered place. When both sides can say "request 4.04 is answered in folder 4", the weekly "where are we" call becomes a five-minute review of the Pending rows.

Step 1: Build the folder tree from the categories

Create the 10 top-level folders in checklist order, plus a confirmatory folder last. On Peony's Data Room plan, AI room generation drafts a folder structure from a one-line description of the deal ("$30M manufacturing sale to a PE platform"); you edit it, then upload into it. A built-in template or the skeleton above works too.

Step 2: Number the room and export the index

Turn on Index documents in the room's Settings tab. Peony then numbers every folder and file (1, 1.1, 1.2) so both sides can say "open 2.3". Export index downloads the numbered list, which you can attach to your first request-list response so the buyer's team can see where everything sits. Both are on the Data Room plan ($52 per admin per month billed yearly, $75 monthly) and above.

Step 3: Add four columns to the buyer's spreadsheet

Keep the buyer's IDs and wording untouched and add your own columns to the right: Room ref (for example, 4.2 Change-of-control schedule.xlsx), Status, Owner and Date. If the buyer uses its own numbering, keep a mapping column rather than renumbering their list.

Pending vs N/A is where most lists go wrong. Pending is a promise with a date; N/A is a fact with a reason. A blank row is neither, and buyers read it as a problem you have not disclosed. If a document should exist but does not (no sales tax nexus study, no written contract with a long-standing supplier), say so and say what you will provide instead, such as invoices or a summary of terms.

Step 4: Map requests to folders, not file positions

Index numbers follow the order of items in each folder, so a file added or moved above another shifts the numbers below it. Point each row at a folder number and quote the file name with it. Two more traps from running this in practice:

• Different groups can see different numbers. Numbering follows what each visitor group can see, and hidden folders are skipped. Put gated folders, such as the confirmatory folder, at the end of the tree, and the numbers of everything before them stay identical for every bidder group.
• Version uploads take the new file's name. If your file names carry request IDs, rename after uploading a new version.

Step 5: Replace documents with Upload new version

When the AR aging is refreshed or a contract is re-signed, use Upload new version on the existing file instead of uploading a second copy. The file keeps its place in the room and its link, every earlier version stays one click away in the version menu, and the request-list row does not change. Two versions of the same schedule side by side invite the question of which one is true.

Step 6: Release in stages and take follow-ups in Q&A

Turn on Hide new content by default so new uploads stay hidden until you grant a visitor group access in Permissions (group permissions are on the Data Room plan). That lets you load confirmatory files early and release them to the final bidder with one change. Questions that come back go to Visitor Q&A rather than new spreadsheet rows: on Data Room, AI drafts a cited first answer from the room's own documents, your team reviews and edits it, and nothing reaches the bidder until you publish it. Deal Team ($64 per admin per month billed yearly, minimum 4 admins) adds expert and approver routing.

Why the spreadsheet plus a numbered index works: the request list is the buyer's document, so buyer's counsel keeps editing the file they issued instead of re-entering requests into a seller's tool, and every row resolves to one numbered place in the room that both sides can open. Peony has no built-in request-list or request-tracker module; Index documents and Export index are what tie each row to a document. If the buyer insists on tracking requests inside the VDR itself, check for that module before you choose a platform.

Start now

---

What do the 2026 numbers say about due diligence volume and timing?

In 2026, a sub-$50M M&A room holds about 1,206 files and draws about 79 Q&A questions, rooms take about two weeks to open to buyers, and diligence runs a median 170 days on Datasite's platform. Every figure below is from October 2025 or later, or is a standing reference.

The two preparation figures are the ones to plan around. Datasite's 12-day median and Peony's 12.6-day median measure slightly different things on different platforms, yet land within a day of each other. The time goes into collecting, reviewing and redacting documents, which is why a seller who has worked through the checklist before the LOI answers the first request list in days rather than weeks.

---

The master checklist: 174 numbered documents in 10 categories

The master checklist runs from 1.01 (articles of incorporation) to 10.16 (compliance training and hotline reports): 174 numbered documents in 10 categories. It is a synthesis of the request lists law firms and accountants send in practice, cross-checked against Bloomberg Law's 174 document types. Each category explains why buyers ask, so you can anticipate the follow-up question. Items marked (Week 1) are the 31 on the Week-One Request Ladder; lookbacks are in brackets where they matter.

1. Corporate & Governance (18 documents)

Why buyers request this: Counsel confirms that the sellers have authority to sell, who really owns the company, and which approvals or consents the sale needs. A cap table that does not reconcile to the stock ledger stops counsel until it does. For investor-specific expectations, see the data room for investors guide.

• 1.01 Certificate or articles of incorporation or organization, with all amendments (Week 1)
• 1.02 Bylaws or operating agreement, with all amendments (Week 1)
• 1.03 Corporate structure chart: every entity, subsidiary and ownership percentage (Week 1)
• 1.04 Current officers, directors and managers
• 1.05 Board, committee and shareholder minutes (3–5 years)
• 1.06 Written consents in lieu of meetings (3–5 years)
• 1.07 Fully diluted cap table: shares, options, warrants, SAFEs and notes (Week 1)
• 1.08 Stock ledger and option ledger, reconciled to the cap table (Week 1)
• 1.09 Equity incentive plan, option and warrant agreements, and the board approval behind each grant
• 1.10 Convertible notes and SAFEs, with how each converts at the deal price
• 1.11 Stockholder, voting, buy-sell and right-of-first-refusal agreements (Week 1)
• 1.12 Investor rights and registration rights agreements
• 1.13 Consents the sale itself needs: board and shareholder votes, drag-along, ROFR waivers (Week 1)
• 1.14 Jurisdictions where each entity is qualified to do business
• 1.15 Good-standing certificates from the state of formation and each qualified state
• 1.16 Joint venture and partnership agreements
• 1.17 Names used in the last 5 years (DBAs and trade names)
• 1.18 Prior acquisition, merger and divestiture agreements

2. Financial (24 documents)

Why buyers request this: The accountants rebuild your earnings from source records, test every adjustment to adjusted EBITDA, and set the working capital peg. An add-back without an invoice, contract or payroll record behind it is usually removed. If you commissioned a quality of earnings report, put it first; the financial due diligence guide covers what reviewers test.

• 2.01 Audited or reviewed annual financial statements: balance sheet, income statement, cash flow (3–5 years) (Week 1)
• 2.02 Monthly management accounts (24–36 months) (Week 1)
• 2.03 Year-to-date financials against the prior-year period (Week 1)
• 2.04 Adjusted EBITDA (or SDE) bridge with support for every add-back (3 years plus trailing twelve months) (Week 1)
• 2.05 Sell-side quality of earnings report, if one exists (Week 1)
• 2.06 General ledger and trial balances (3 years)
• 2.07 Bank statements for every account (12–36 months) (Week 1)
• 2.08 Revenue waterfall: billings to recognized revenue reconciliation
• 2.09 Accounts receivable aging (current plus 12 month-ends) (Week 1)
• 2.10 Accounts payable aging (current plus 12 month-ends)
• 2.11 Net working capital by month (12–24 months)
• 2.12 Inventory listing, valuation method and reserves (if applicable)
• 2.13 Deferred revenue and customer deposit schedule
• 2.14 Debt schedule: loans, lines of credit, notes and guarantees (Week 1)
• 2.15 Debt covenant compliance certificates and lender reporting
• 2.16 Debt-like items: accrued bonuses, deferred rent, unpaid taxes, earn-outs owed
• 2.17 Capital expenditure history and plan, with the fixed asset register
• 2.18 Budget and forecast with assumptions (current year plus 1–3 years)
• 2.19 Budget-to-actual comparisons (2–3 years)
• 2.20 Accounting policies, including revenue recognition
• 2.21 Auditor management letters and proposed adjustments
• 2.22 Related-party and intercompany transaction schedule
• 2.23 Off-balance-sheet commitments
• 2.24 Backlog report (if applicable)

3. Tax (15 documents)

Why buyers request this: Unpaid sales, payroll and state income tax follow the business, completely in a stock sale. Sales tax nexus is the item that most often surprises sellers who ship across state lines. Cross-border targets add transfer pricing and withholding, covered in the international tax due diligence guide.

• 3.01 Federal income tax returns (at least 3 years; 6 if income may have been under-reported by more than 25%) (Week 1)
• 3.02 State and local income and franchise tax returns (3–5 years)
• 3.03 Tax structure: entity classification (C corp, S corp election, LLC) and tax chart (Week 1)
• 3.04 Sales and use tax filings and exemption certificates (3–5 years)
• 3.05 Sales tax nexus analysis: the states where the company should be collecting
• 3.06 Payroll tax filings, Forms 941, W-2 and 1099 summaries (4 years)
• 3.07 Property tax returns and assessments
• 3.08 Tax provision workpapers and book-to-tax reconciliation
• 3.09 Schedule of net operating losses, credits and carryforwards
• 3.10 Section 382 ownership-change analysis (if NOLs matter to price)
• 3.11 R&D tax credit studies
• 3.12 Tax audits, notices, correspondence and settlements (5 years)
• 3.13 State apportionment schedules
• 3.14 Transfer pricing documentation (multi-entity or cross-border)
• 3.15 Tax sharing and tax indemnity agreements

4. Legal, Contracts, Insurance & Litigation (24 documents)

Why buyers request this: Counsel tests whether revenue or supply could be interrupted by the sale and what claims come with the company. Contracts with change-of-control or anti-assignment provisions are the most time-sensitive items, because a counterparty consent found late can push a closing. The legal due diligence guide covers what counsel reads.

• 4.01 Material contracts list, with the dollar threshold used (Week 1)
• 4.02 Top 10–20 customer agreements, with amendments (Week 1)
• 4.03 Top 10–20 supplier and vendor contracts (Week 1)
• 4.04 Schedule of contracts with change-of-control or anti-assignment clauses (Week 1)
• 4.05 Standard MSA, terms of service or EULA
• 4.06 Distribution, reseller, agency and channel agreements
• 4.07 Non-compete, exclusivity and most-favored-nation clauses in commercial contracts
• 4.08 Outbound license and royalty agreements
• 4.09 Government contracts
• 4.10 Loan agreements, indentures and guarantees
• 4.11 Security agreements, pledges and UCC lien search results
• 4.12 Real estate and equipment leases (Week 1)
• 4.13 Contracts with related parties
• 4.14 Letters of intent, term sheets or pending agreements with third parties
• 4.15 Indemnification agreements
• 4.16 Powers of attorney
• 4.17 Third-party consents needed to close
• 4.18 Pending and threatened litigation summary (5 years) (Week 1)
• 4.19 Settlement agreements, judgments and consent decrees
• 4.20 Attorney letters to auditors (3 years)
• 4.21 Insurance schedule and policies: general liability, property, D&O, E&O, cyber (Week 1)
• 4.22 Loss runs and claims history (3–5 years)
• 4.23 Product liability, warranty and recall history
• 4.24 Subpoenas and government investigations

5. Customers & Revenue (13 documents)

Why buyers request this: Three questions, fast: how concentrated is revenue, how predictable are renewals, and where will growth come from. A single customer with a large share of revenue usually gets its own question and can change the structure of the offer, through an earn-out or an escrow tied to that customer. The commercial due diligence guide covers how buyers read the pipeline.

• 5.01 Customer list with revenue, contract term and renewal date (anonymized until the final round) (Week 1)
• 5.02 Revenue concentration: top 1, 5, 10 and 20 customers (3 years) (Week 1)
• 5.03 Revenue by product, segment and geography (3 years)
• 5.04 Renewal calendar (next 12–24 months)
• 5.05 Pricing, discount and rebate policies
• 5.06 Pipeline by stage with historical conversion rates
• 5.07 Win/loss analysis (12–24 months)
• 5.08 Churn and retention: logo churn, dollar churn, net revenue retention
• 5.09 Channel and partner revenue split
• 5.10 Customer satisfaction data (NPS, CSAT, support tickets)
• 5.11 Customer complaints and disputes log (3 years)
• 5.12 Open purchase orders and purchase commitments
• 5.13 Market and competitive landscape analysis

6. HR & Employment (19 documents)

Why buyers request this: Buyers look for three kinds of cost: people the business cannot keep, workers who were classified wrongly, and payments the sale itself triggers. The census is the core document and stays anonymized until the shortlist. The HR due diligence guide goes deeper.

• 6.01 Organizational chart with headcount by department (Week 1)
• 6.02 Employee census: role, hire date, location, pay, exempt status (anonymized) (Week 1)
• 6.03 Key executive employment and retention agreements
• 6.04 Employment agreement and offer letter templates
• 6.05 Contractor and consultant list, with agreements and classification rationale
• 6.06 Non-compete, non-solicit and confidentiality agreements with key people
• 6.07 Compensation bands
• 6.08 Bonus, commission and sales incentive plans
• 6.09 Severance, retention and change-of-control payments the sale triggers (Week 1)
• 6.10 Benefit plans (health, 401(k), ESOP) with Form 5500 filings (3 years)
• 6.11 Employee handbook and HR policies, including PTO
• 6.12 Accrued PTO and unpaid compensation
• 6.13 Payroll registers reconciled to the general ledger (3 years)
• 6.14 Employment claims and EEOC or state agency charges (5 years)
• 6.15 Workers' compensation claims history
• 6.16 Form I-9 and work authorization compliance; visa sponsorships
• 6.17 Union and collective bargaining agreements
• 6.18 Layoff history and WARN Act notices (3 years)
• 6.19 Wage-and-hour audits and Department of Labor correspondence

7. IP & Technology (16 documents)

Why buyers request this: Reviewers confirm that the company owns what it sells and that the technology can be maintained without license gaps or brittle dependencies. The single most important document is the invention assignment signed by everyone who wrote code or designed product. See IP due diligence for the detail.

• 7.01 Invention and IP assignment agreements: founders, employees, contractors (Week 1)
• 7.02 Patents and applications, with prosecution history
• 7.03 Trademark registrations and applications
• 7.04 Copyright registrations
• 7.05 Domain names and social media accounts
• 7.06 Trade secret policies and protections
• 7.07 Inbound software and technology licenses
• 7.08 Open-source inventory and license review
• 7.09 Architecture overview and major third-party dependencies
• 7.10 Source code escrow agreements
• 7.11 Freedom-to-operate analyses or opinions
• 7.12 IP disputes, infringement claims and cease-and-desist letters (5 years)
• 7.13 Product roadmap and release history
• 7.14 SaaS and software subscriptions list
• 7.15 AI models and training data: provenance, rights and licenses (if applicable)
• 7.16 Development agreements with outside developers and agencies

For AI-focused targets, Skadden (January 2026) points buyers at training-data provenance and rights, how models were trained and how they hold up under red-teaming, whether compute costs are sustainable at commercial volumes, and whether know-how sits with a few key people.

8. Security & Privacy (14 documents)

Why buyers request this: A breach found after closing becomes the buyer's cost, and that cost keeps rising: IBM's 2026 report put the global average cost of a data breach at $4.99 million and the US average at $11.5 million (Baker Donelson, July 2026). The cybersecurity due diligence guide covers the review.

• 8.01 Security program mapped to NIST CSF 2.0 or ISO 27001
• 8.02 Security incident log and response plan (3–5 years)
• 8.03 Latest penetration test and remediation status (last 12 months)
• 8.04 SOC 2 Type II report or equivalent attestation
• 8.05 Encryption policies, at rest and in transit
• 8.06 Access control and identity management policies
• 8.07 Endpoint detection and response coverage
• 8.08 Vendor risk management program
• 8.09 Security awareness training records
• 8.10 Cyber insurance policy and claims history
• 8.11 Privacy notices and personal data map
• 8.12 Data processing agreements with vendors
• 8.13 GDPR, CCPA and state privacy law compliance records
• 8.14 Business continuity and disaster recovery test results

Historical examples: in 2017 Verizon cut its price for Yahoo's core business by $350 million after Yahoo disclosed two large breaches (CNN Money). Marriott bought Starwood in 2016; attackers had been inside Starwood's systems since 2014, and in 2020 the UK ICO fined Marriott £18.4 million (Mayer Brown).

9. Operations, Real Estate & Facilities (15 documents)

Why buyers request this: The buyer needs to know whether the business runs the day after closing: which suppliers it cannot replace, what the equipment really costs to keep, and which sites it occupies on what terms.

• 9.01 Business overview and key operating processes
• 9.02 Customer SLAs and support processes
• 9.03 Vendor SLAs for critical services
• 9.04 Supply chain map and single-source suppliers
• 9.05 Quality management documentation (ISO certifications if any)
• 9.06 Equipment list with age, condition and maintenance records
• 9.07 Facility list: address, use, square footage, owned or leased
• 9.08 Deeds and title policies for owned property
• 9.09 Surveys and zoning reports (if real estate is included)
• 9.10 Facility inspection and property condition reports
• 9.11 Key standard operating procedures and training materials
• 9.12 Outsourcing and managed-services agreements
• 9.13 IT systems inventory (ERP, CRM, accounting)
• 9.14 Capacity utilization (manufacturing)
• 9.15 Transition services needs and shared-services map (carve-outs)

10. Regulatory, Compliance & Environmental (16 documents)

Why buyers request this: Reviewers need to know whether staying compliant after closing needs new systems, people or time, and whether licenses move with the business. Some permits transfer with a stock sale but must be reissued in an asset sale. Regulated targets should read the regulatory due diligence guide.

• 10.01 Licenses, permits and approvals, with transferability (Week 1)
• 10.02 Regulatory examination and inspection reports (3–5 years)
• 10.03 Active remediation plans or consent orders
• 10.04 Anti-corruption (FCPA) compliance program
• 10.05 Sanctions screening procedures
• 10.06 Export control compliance (ITAR or EAR, if applicable)
• 10.07 Industry certifications (HIPAA, PCI DSS, FedRAMP and similar)
• 10.08 Lobbying and political contribution disclosures
• 10.09 OSHA 300 logs and safety records (5 years)
• 10.10 Environmental permits: air, water, waste
• 10.11 Phase I environmental site assessments, and Phase II if any
• 10.12 Hazardous materials inventory and remediation history
• 10.13 EPA and state environmental notices of violation
• 10.14 Product certifications and quality audits
• 10.15 Correspondence with sector regulators (FDA, SEC, FTC, FCC and similar)
• 10.16 Compliance training records and hotline reports

---

Which documents do industry overlays add?

Industry overlays add the documents buyers in a sector expect on top of the 174: recurring-revenue metrics for SaaS, regulatory filings for biotech, title and environmental work for real estate, and equipment and environmental records for manufacturing. Use the dedicated checklists for the full list: SaaS financial due diligence, e-commerce, real estate and dental practices. What each overlay adds, in short:

SaaS companies

• ARR/MRR bridge: new, expansion, contraction and churn, month by month
• Cohort retention: gross and net dollar retention by cohort vintage
• CAC payback and LTV:CAC by acquisition channel
• Gross margin build separating software delivery from professional services
• Deferred revenue schedule and ASC 606 revenue recognition policy
• Hosting cost breakdown by provider and service, with the trend
• Product usage data: active users, feature adoption
• Code quality metrics: test coverage, deployment frequency, incident response

Biotech and pharma

• FDA and EMA correspondence, including warning letters and Form 483 observations
• IND, NDA and BLA filings for each product
• Clinical trial documentation: protocols, IRB approvals, statistical analysis plans
• GCP, GLP and GMP inspection reports and CAPA plans
• Freedom-to-operate opinions and patent term extensions
• CMO and CDMO manufacturing agreements
• Pharmacovigilance and adverse event reporting
• Exclusivity analysis: orphan drug and pediatric exclusivity

See the biotech data room guide for room structure and healthcare due diligence for provider deals.

Real estate

A Phase I Environmental Site Assessment is not legally required, but it is the standard way a buyer satisfies EPA's All Appropriate Inquiries rule, which a buyer must complete before acquiring property to claim CERCLA's landowner liability protections; EPA recognizes ASTM E1527-21 as consistent with the rule (EPA, updated May 2026).

• ALTA survey certified to buyer and lender
• Title commitment and exception documents
• Rent roll with lease abstracts, and estoppel certificates from tenants
• SNDA agreements
• Property condition assessment
• Phase I ESA, and Phase II if the Phase I found recognized environmental conditions
• Zoning report and certificate of occupancy
• Operating statements, property tax bills and CAM reconciliations (3–5 years)

Manufacturing

Environmental and equipment documents run deeper in manufacturing, because deferred maintenance capex and remediation liability both move the price. The manufacturing due diligence guide covers the workstream.

• Equipment list with replacement cost and maintenance vs growth capex split
• Capacity utilization and production flow
• Bill of materials for key products and raw material pricing contracts
• Inventory turns, obsolescence and safety stock
• OSHA citations and injury rates
• Environmental permits, hazardous materials inventory and EPA correspondence
• Warranty claims and product liability history
• Customer quality scorecards (automotive and aerospace suppliers)

---

What is changing in due diligence in 2026?

Three shifts change what goes on the list and how it is answered: AI now reads the room alongside the buyer's team, cybersecurity sits on every list, and ESG requests depend on EU exposure.

AI-assisted review is now part of the process

Buyers use AI where it pays back: in the Bain & Company and StepStone Group 2026 private equity GP outlook (March 2026, a survey of more than 100 GP investment and investor relations professionals), "GPs report the highest returns from generative AI in deal sourcing and due diligence" (press release). For sellers, that means the room gets read faster and more completely, so gaps surface sooner.

Inside a Peony room, AI document Q&A (Business and above) answers questions across the room with page-level citations, and the seller turns AI chat on or off per visitor group, so a bidder can be allowed to interrogate the documents inside the room. In Visitor Q&A, AI drafts a cited first answer to each bidder question from the room's own documents; your team reviews and edits it, and nothing reaches the bidder until you publish. Document content is not used to train any model.

Cybersecurity is on every list

Category 8 used to appear only on technology deals; it is now standard. With the IBM 2026 global average breach cost at $4.99 million, buyers ask for the incident log, the latest penetration test and the privacy data map in the second week of almost every process I see.

ESG requests depend on EU exposure

Whether ESG documents belong on the list now depends mostly on EU exposure. After the EU's Omnibus amendments, CSRD reporting covers companies with more than 1,000 employees on average and more than €450 million net turnover, and CSDDD obligations apply from July 26, 2029 (Morgan Lewis, March 2026). If your deal has an EU nexus, add the ESG and environmental due diligence documents and confirm with counsel whether the narrowed scope applies.

---

Which document mistakes delay deals most?

The six document mistakes that most often delay a closing are missing IP assignments, undiscovered change-of-control clauses, thin cybersecurity records, a disorganized room, over-sharing too early and answering the request list by email. Each is avoidable before the request list arrives.

1. Missing IP assignment agreements

Founders, early employees and contractors often never signed invention assignments. If the company cannot prove it owns its core IP, the deal stalls or the price drops.

Fix: Audit item 7.01 before launch. Everyone who wrote code, designed product or created content should have a signed assignment on file; counsel can paper confirmatory assignments for former contractors.

2. Undiscovered change-of-control provisions

Sellers often do not know which contracts need counterparty consent for a sale. Found late, a consent becomes a closing condition you do not control.

Fix: Before diligence, search every material contract for "change of control", "assignment" and "consent", and build item 4.04 as a schedule. Renew or get consent on large contracts that expire soon after closing.

3. Incomplete cybersecurity documentation

Many sellers have no documented security program, incident log or penetration test, and the absence reads as risk.

Fix: Map your controls to NIST CSF 2.0 or ISO 27001. If you have never had a penetration test, commission one; imperfect results with a remediation plan show good faith.

4. Poor data room organization

Many follow-up questions are not about missing documents at all; the buyer simply could not find them. That wastes time on both sides and erodes confidence.

Fix: Use the 10-category structure, number the room, and add a short "what's here" note at the top of each folder saying what it holds and what is still pending. Name files consistently (for example, 2026-09_Customer_MSA_Acme.pdf) and replace revised files with Upload new version instead of adding _v2 copies.

Maintenance cadence: management accounts, pipeline and headcount monthly; financial statements, budget variance and customer metrics quarterly; new contracts, litigation updates and regulatory filings as they happen. Outdated financials undermine credibility faster than missing ones.

5. Over-sharing sensitive documents too early

Releasing employee-level pay, customer-identifying data and disclosure schedules to unqualified bidders creates competitive risk and damages trust if the deal falls through.

Fix: Stage disclosure in three phases (see staged disclosure) and keep confirmatory documents behind an NDA gate and group permissions until terms are agreed.

6. Answering the request list by email

Fifty attachments across thirty threads cannot be audited, and three weeks in nobody knows which version of the AR aging the buyer has. Email also loses the record of who opened what.

Fix: Every answer goes into the room against a request ID, and the spreadsheet carries the room reference. Questions go to Q&A, not to new email threads.

---

How do you organize this checklist in Peony?

Peony runs the checklist as a numbered room: AI room generation drafts the folder tree, Index documents numbers every folder and file, and page-level analytics show what each reviewer reads. More than 8,000 customers in 60+ countries use Peony, with $44.7B in client assets. Here is how the checklist maps to a Peony data room.

Step 1: Create the room and draft the structure

Create a data room and describe the deal in one line; AI room generation proposes a folder structure, which you edit before uploading. On Peony, the median account goes from creation to its first uploaded document in 4 minutes 19 seconds (State of M&A Data Rooms, Q3 2026).

Step 2: Upload in bulk and number the room

Drag whole folders in. Uploads are resumable, so a dropped connection picks up where it stopped, and there is no per-file size limit on any plan. On the Data Room plan, auto-indexing automatically numbers and organizes uploaded documents into a structured index for easy navigation: turn on Index documents so every folder and file carries its number, and use Export index to send the buyer the numbered list.

Here is the folder structure I recommend (with Index documents on, drop the number prefixes from the names):

1  Corporate & Governance
   1.1 Formation & Governance
   1.2 Cap Table & Equity
   1.3 Shareholder Agreements & Consents
2  Financial
   2.1 Annual Statements & QoE
   2.2 Monthly Accounts & Working Capital
   2.3 Debt & Debt-Like Items
   2.4 Budgets & Forecasts
3  Tax
   3.1 Returns
   3.2 Sales Tax & Nexus
   3.3 Credits, NOLs & Audits
4  Legal, Contracts, Insurance & Litigation
   4.1 Material Contracts
   4.2 Change-of-Control Schedule
   4.3 Leases
   4.4 Litigation
   4.5 Insurance
5  Customers & Revenue
6  HR & Employment
7  IP & Technology
8  Security & Privacy
9  Operations, Real Estate & Facilities
10 Regulatory, Compliance & Environmental
11 Confirmatory (gated, last in the tree)

Pro tip: add a "what's here" note. At the top of each major folder, a short note on what the folder contains, why a buyer needs it and what is still pending answers most navigation questions before they are asked. It also signals that you understand the process, not just the documents.

Step 3: Let buyers interrogate the documents

AI document Q&A answers questions across the room with page-level citations (Business and above, with 5x usage on Data Room and 10x on Deal Team). You choose which visitor groups can use it.

Step 4: Track reviewer engagement with page-level analytics

Page-level analytics, on every plan, show which pages each reviewer read, for how long, and where they went back for a second look. That tells you which categories are drawing scrutiny and where the next question will come from. Is the buyer spending unusual time in the legal folder? Has the operating partner opened the financials yet?

Security features for due diligence rooms, by plan

• Free ($0): 50 documents as tracked single-file links, with page-level analytics, password protection, email capture and link expiry. Data rooms start on Business.
• Business ($30 per admin per month billed yearly, $44 monthly): 3 data rooms per admin and 100 GB, viewer email verification, an NDA acknowledgement gate, screenshot protection, download prevention, remote revocation and AI document Q&A.
• Data Room ($52, $75 monthly): unlimited rooms and storage, a signed NDA with audit record, dynamic watermarks, granular folder and file permissions by group, a full audit trail, Index documents, AI room generation, Visitor Q&A and a custom domain.
• Deal Team ($64, $89 monthly, minimum 4 admins): advanced redaction, Advanced Q&A routing, per-room domains and branding, and room archive download.

Viewers are unlimited and free on every plan. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway.

Start now

---

Which data room should run your checklist?

The best data room for a due diligence checklist is the one that gets a secure, numbered room in front of reviewers fastest and then shows you what they read. For the full field ranked by diligence workflow, see best data rooms for due diligence. Here is the short version.

1. Peony: best for mid-market speed and visibility

Peony is built for deal workflows: a median 4 minutes 19 seconds from sign-up to first upload, AI room generation and Index documents for structure, page-level analytics on every plan, and AI document Q&A with page citations. Data Room at $52 per admin per month billed yearly covers unlimited rooms and storage, signed NDAs, dynamic watermarks, group permissions and Visitor Q&A, and viewers are free. Sub-$50M rooms on Peony averaged $219 a month in Q3 2026.

Best for: sell-side M&A under $500M, PE add-ons, growth equity and fundraising. For the M&A setup playbook, see the M&A data room guide.

2. iDeals: established mid-market VDR

iDeals is a long-running mid-market data room with granular permissions, Q&A and bulk upload, sold on quoted plans. Best for: mid-market M&A and legal teams that want a traditional VDR with vendor-led support.

3. Firmex: for advisory firms running several deals

Firmex sells subscription data rooms that suit advisory firms and funds running several processes at once. Vendr puts the average contract at about $7,800 a year. Best for: advisory firms and PE funds with steady deal flow.

4. Datasite: enterprise standard for large-cap M&A

Datasite is the enterprise standard for large and cross-border transactions, with sales-led onboarding. Vendr puts the average contract at about $68,000 a year. Best for: large-cap deals where banks and counsel standardize on it.

When an enterprise VDR is the right call: on deals above $500M, or where the bank or buyer's counsel requires Datasite or Intralinks, use the platform the process requires. The same applies if the buyer insists on tracking its request list inside the VDR, since Peony keeps the list in your spreadsheet and maps it to the numbered index.

---

What should you share at each phase of staged disclosure?

Stage disclosure in three phases instead of giving every reviewer everything. It is standard practice in M&A and fundraising, and it protects you if a process falls through.

Phase 1: Preliminary (all qualified parties)

Share after the NDA with any party that passes initial qualification.

• Company overview and corporate structure (Category 1 highlights)
• Summary financials: revenue, growth, EBITDA or burn
• Management team and product overview
• Market positioning

Purpose: let buyers decide whether the opportunity fits their thesis before they commit resources.

Phase 2: Detailed (shortlisted bidders)

Share with the parties that submit indicative bids.

• Full financial statements and projections (Category 2)
• Tax filings and analysis (Category 3)
• Material contracts with the change-of-control schedule (Category 4)
• Customer data with concentration analysis, anonymized (Category 5)
• IP portfolio and architecture (Category 7)
• Security program documentation (Category 8)
• Operations and compliance (Categories 9 and 10)

Purpose: give bidders enough to submit binding offers.

Phase 3: Confirmatory (final bidder only)

Share only with the selected bidder, near signing.

• Employee-level compensation and HR detail (Category 6 sensitive items)
• Individual customer contracts and pricing
• Disclosure schedules for the definitive agreement
• Sensitive litigation detail and reserves
• Confirmatory financial schedules

Purpose: validate the representations and warranties before closing. This is too sensitive to share with competing bidders.

On Peony's Data Room plan, each phase maps to a visitor group with its own folder and file permissions, so you widen a party's access as it advances without building separate rooms. Hide new content by default keeps confirmatory uploads hidden until you grant access, NDA gates enforce signature before any access, and link expiry and revocation cut off bidders who leave the process.

---

FAQ

What is a due diligence data room checklist?

A due diligence data room checklist is the full list of documents a seller loads into a virtual data room so a buyer or investor can verify the business before closing. Peony's version has 174 numbered items across 10 categories: corporate and governance, financial, tax, legal and contracts, customers and revenue, HR, IP and technology, security and privacy, operations, and regulatory compliance. The item numbers double as folder numbers, so item 4.04 lives in folder 4. Bloomberg Law's M&A checklist also lists 174 types of documents to consider requesting. The checklist is what you prepare; the buyer's request list is what you answer.

What is a due diligence request list, and when does the buyer send it?

A due diligence request list is the buyer's itemized list of the documents and information it wants, usually a spreadsheet with one row per request, a category, a requested-by date and a column for the seller's response. Buyer's counsel and the buyer's accountants usually send it within days of the signed letter of intent, once exclusivity starts the diligence clock. Some buyers send a short list before the LOI to price the offer. Expect follow-up lists after the first delivery, because the list grows as reviewers read.

What is the difference between a due diligence checklist, a request list and a DDQ?

A due diligence checklist is the seller's master list of what a complete data room contains. A request list is the buyer's deal-specific version, with a deadline and a status for each row. A due diligence questionnaire (DDQ) asks for written answers rather than documents and is common in fund investing and vendor reviews. Data room Q&A handles the follow-up questions that come after reviewers read the documents. One deal often uses all four. See the DDQ guide and data room Q&A.

How many documents do buyers typically request in due diligence?

The full superset is about 174 document types: Bloomberg Law's M&A checklist lists 174 types of documents to consider requesting, and Peony's checklist has 174 numbered items. No deal needs every line. What fills the room is measurable: across 733 M&A transactions on Peony (Q3 2026 edition), a sub-$50M room held about 1,206 files, 29 users and 79 Q&A questions, and a $100M to $500M room about 6,622 files, 109 users and 309 questions. Peony's Data Room plan ($52 per admin per month billed yearly) includes unlimited rooms and storage, and Index documents numbers every folder and file so each request maps to one place.

What documents do buyers request first after the LOI?

Buyers ask first for the documents that settle five questions: who can sign (charter, bylaws, the fully diluted cap table and the consents the sale needs), whether the earnings are real (3 to 5 years of annual statements, 24 to 36 months of monthly accounts, the EBITDA bridge, bank statements and tax returns), whether revenue survives a change of owner (top customer and supplier contracts and the change-of-control schedule), what liabilities come along (debt, leases, litigation and insurance) and what has to transfer (employee census, IP assignments and permits). That is 31 of the 174 checklist items, the Week-One Request Ladder.

How many years of financial statements and tax returns do buyers want?

Most buyers ask for 3 to 5 years of annual financial statements and tax returns and 24 to 36 months of monthly accounts. The 3-year floor tracks the IRS: the general period of limitations is 3 years, it is 6 years if income was under-reported by more than 25%, and there is no limit if a return was never filed or was fraudulent. Payroll records go back 3 years because federal rules require employers to keep them that long, OSHA injury logs go back 5 years, and litigation summaries usually cover 5 years.

How fast should a seller respond to a due diligence request list?

Plan to deliver the first tranche in about two weeks and to answer follow-ups within days. Datasite reported a 12-day global median preparation time in Q3 2026, and the median Peony room took 12.6 days from first opening to its first outside viewer in the same quarter. Diligence itself ran a 170-day median on Datasite in Q3 2026. A practical standard: the 31 week-one items within 10 business days, every other row acknowledged with a status and a date, and no row left blank.

How do I track a due diligence request list in a data room?

Keep the request list as the tracker and make the data room its filing system. Add a room reference, a status and an owner to every row of the buyer's spreadsheet. On Peony's Data Room plan ($52 per admin per month billed yearly), Index documents numbers every folder and file (1, 1.1, 1.2) and Export index downloads the numbered list, so each row can point at a folder number plus a file name. Peony has no built-in request-tracker module, so statuses live in the spreadsheet. Upload new version replaces a file without changing its place or link, and Visitor Q&A takes the follow-up questions inside the room.

What should I do if I don't have a document on the buyer's request list?

Never leave the row blank. Mark it N/A when the document does not apply and say why in one sentence, for example no union employees, so no collective bargaining agreement. Mark it Pending when the document exists but is not ready, with an owner and a date. If you will not provide it, say so with counsel's reason, such as privilege or a confidentiality obligation, and offer an alternative such as a summary or a clean-team review. A blank row reads as a hidden problem and triggers a follow-up question that costs more time than the sentence would have.

What are the 10 categories of a due diligence checklist?

The 10 categories are: (1) corporate and governance, (2) financial, (3) tax, (4) legal, contracts, insurance and litigation, (5) customers and revenue, (6) HR and employment, (7) IP and technology, (8) security and privacy, (9) operations, real estate and facilities, and (10) regulatory, compliance and environmental. In Peony's 174-item checklist they hold 18, 24, 15, 24, 13, 19, 16, 14, 15 and 16 items. Number the room's top-level folders 1 to 10 in the same order, so a checklist ID such as 2.09 points straight to folder 2.

What documents do sellers most commonly forget in a data room?

The gaps that most often stall a deal are invention assignment agreements from founders and contractors, a schedule of contracts with change-of-control or anti-assignment clauses, a sales tax nexus analysis, contractor classification support, the board approvals behind option grants, and a list of the payments the sale itself triggers, such as retention and change-of-control bonuses. Each is cheap to fix before launch and expensive to discover in week three. Run the 174-item checklist against your room before buyers arrive.

How long does due diligence take in 2026?

Diligence typically runs five to six months in 2026: Datasite reported a 170-day global median diligence time in Q3 2026, down from 174 days a year earlier, with APAC the slowest at 235 days. From start to closing, M&A deals on Peony took about 7.9 months on average in the Q3 2026 edition of the State of M&A Data Rooms (733 transactions). The preparation window before buyers get in is about two weeks: a median 12.6 days from a Peony room's first opening to its first outside viewer.

How should I stage document disclosure during due diligence?

Stage it in three phases. Phase 1 (preliminary, after the NDA) shares the company overview, summary financials and corporate structure with every qualified party. Phase 2 (detailed, shortlisted bidders) releases full financials, material contracts, customer data and IP. Phase 3 (confirmatory, final bidder only) opens employee-level pay, customer-level pricing and disclosure schedules. On Peony's Data Room plan, each phase maps to a visitor group with its own folder and file permissions, and Hide new content by default keeps new uploads hidden until you grant a group access. An NDA gate starts on Business, and a signed NDA with an audit record on Data Room.

What is a due diligence data room?

A due diligence data room is a secure online repository where a company shares the documents that investors, acquirers or partners need to evaluate it before a transaction closes. Unlike general cloud storage such as Google Drive or Dropbox, it puts an NDA in front of the documents, shows who read which page, and stamps each viewer's identity on confidential pages. Peony is a data room used by 8,000+ customers in 60+ countries. Data rooms start on Business at $30 per admin per month billed yearly; Data Room at $52 adds unlimited rooms, signed NDAs, dynamic watermarks and a full audit trail; page-level analytics come on every plan, and viewers are unlimited and free.

What security features should a due diligence data room have?

A due diligence data room should have an NDA gate before any document opens, viewer email verification, folder- and file-level permissions by group, download prevention and screenshot protection, dynamic watermarks that stamp each viewer's identity on every page, link expiry and instant revocation, and a full audit trail of every view. On Peony, page-level analytics and link expiry come on every plan. Business ($30 per admin per month billed yearly) adds email verification, an NDA acknowledgement gate, screenshot protection, download prevention and remote revocation. Data Room ($52) adds dynamic watermarking, a signed NDA with audit record, granular permissions and a full audit trail. Files are encrypted with AES-256 at rest and TLS 1.2 or higher in transit.

Can I use Google Drive for due diligence?

For internal collaboration, yes; for buyer-facing diligence, it is a weak fit. Google Drive can stop viewers downloading, printing or copying a shared file, but it has no NDA gate, no dynamic watermark naming the viewer on every page, no page-level reading analytics and no structured Q&A for bidders. Peony's Data Room plan ($52 per admin per month billed yearly, $75 monthly) adds signed NDAs, dynamic watermarks, group permissions, a full audit trail, Index documents and Visitor Q&A, and viewers are unlimited and free on every plan.

---

Related Resources

• Due Diligence Questionnaire (DDQ) — the written-answer counterpart to the request list, and when buyers send one
• Data Room Q&A — how follow-up questions are asked, routed and answered inside the room
• How to Prepare for Due Diligence — the seller's preparation timeline before the request list arrives
• Investment Due Diligence Checklist — the buyer and investor side: what to check, not what to provide
• Data Room Folder Structure Guide — folder naming and nesting for the 10-category tree
• State of M&A Data Rooms, Q3 2026 — files, users, Q&A volume and timing across 733 M&A transactions
• SaaS Financial Due Diligence Checklist — the SaaS overlay in full: ARR bridge, cohorts and unit economics
• Tax Due Diligence Checklist — the tax workstream in depth, including nexus and structure
• Real Estate Due Diligence Checklist — property-specific documents for commercial and residential deals
• Best Data Rooms for Due Diligence — platforms ranked on staged access, Q&A and audit records